R4Mbb

**Name of the Vulnerable Software and Affected Versions** Form Maker by 10Web versions prior to 1.15.45 **Description** An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The attack requires a form to be configured with a database-backed dynamic choice field using a WHERE template that references the `{username}` placeholder. An attacker can set their `display name` to a SQL payload via the WordPress profile edit screen and then trigger the `fm reload input` AJAX endpoint to append malicious queries and extract sensitive information from the database. **Recommendations** Update to a version newer than 1.15.44. As a temporary mitigation, avoid using the `{username}` placeholder in the WHERE clause of dynamic-choice fields.

**Name of the Vulnerable Software and Affected Versions** Gutenverse versions prior to 3.8.1 **Description** The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue in the admin settings. This occurs due to insufficient input sanitization and output escaping, allowing authenticated attackers with editor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. The flaw is triggered via the `fonts[].font.font.value` parameter. **Recommendations** Update the plugin to a version newer than 3.8.0.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions prior to 2.4.68 **Description** Improper Privilege Management allows local .htaccess authors to read files using the privileges of the httpd user. **Recommendations** Upgrade to version 2.4.68.

**Name of the Vulnerable Software and Affected Versions** Meow Gallery versions through 5.2.7 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For Meow Gallery versions through 5.2.7, update to a version later than 5.2.7 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.